Beats version 8.4.0

edit

View commits

Breaking changes

edit

Heartbeat - Browser monitors (beta) now write to the synthetics-* index prefix. 32064 - Setting a custom index for a given monitor is now deprecated. Streams are preferred. 32064 - Browser monitors now default to a max concurrency of two. 32564

Bugfixes

edit

Affecting all Beats

  • Fix namespacing for agent self-monitoring, CPU no longer reports as zero. 32336
  • Expand fields in decode_json_fields if target is set. 31712 32010

Auditbeat

  • auditd module: Fix parsing of audit rules where arguments are quoted (like file paths containing spaces). 32421
  • auditd module: Fix minimum AuditStatus length so that library can support kernels from 2.6.32. 32421
  • system/socket: Reduce memory usage of the dataset. 32191 32192

Filebeat

  • Fix counter for number of events published in httpjson input. 31993
  • Fix handling of Checkpoint event for R81. 32380 32458
  • gcp-pubsub input: Restart Pub/Sub client on all errors. 32550 32712

Heartbeat

  • Send targetted error message for unexpected synthetics exits. 31936
  • Reduced memory usage slightly for browser monitors. 32317
  • Automatically kill zombie-ish node processes. 32393
  • Added timeout for browser monitors. 32434
  • Fix bug with browser jobs that had missing check groups or sent empty events. 32542

Metricbeat

  • Update Kubernetes apiserver metricset to not collect deprecated metrics and fix dashboard. 31973
  • Check for nil metadata in GCP. 32281
  • Update Kubernetes controllermanager metricset to not collect deprecated metrics and fix dashboard. 32037
  • Fix ARN parsing for Cloudwatch resource names with leading slashes. 32358
  • Fix an infinite loop in AWS billing metricset. 32626
  • Add missing metrics in AWS Transit Gateway module 32617
  • Replace internal expiring cache used by the Kubernetes module with in-memory dictionary. 32539
  • Oracle Module: Refactor module to use existing host parsers instead of doing its own parsing of hosts. 31611 #31692
  • Oracle Module: Correctly handle special characters in the connection string. 24609 #31368

Winlogbeat

  • Powershell: Fix processing of parameter details. 31833
  • Security: Fix processing of sidlist, access list and access mask. 31833
  • Fix fatal invalid memory write on Windows 11. 32469 32519
  • Fix handling of event formatting when no metadata is available on Windows 11. 32468 32519

Added

edit

Affecting all Beats

  • Improve performance of disk queue by coalescing writes. 31935

Auditbeat

  • Add immutable option to the auditd module. 8352 32381

Filebeat

  • Add auth.oauth2.google.jwt_json option to httpjson input. 31750
  • Add authentication fields to RabbitMQ module documents. 31159 31680
  • Add template helper function for decoding hexadecimal strings. 31886
  • Add new parser called include_message to filter based on message contents. 31794 32094
  • Extend list of mapped record types in o365 Audit module. 32217
  • Add references for CRI-O configuration in input-container and in our Kubernetes manifests. 32149 32151
  • httpjson input: Add replaceAll helper function to template context. 32365
  • Optimize grok patterns in system.auth module pipeline. 32360
  • Checkpoint module: add authentication operation outcome enrichment. 32230 32431
  • Add documentation for decode_xml_wineventlog processor field mappings. 32456

Metricbeat

  • Oracle Module: New sysmetric metricset. 30946 #31462
  • AWS Fargate: Added support for DesiredStatus and KnownStatus. 32077 #32342
  • Enable Generic SQL merge metrics to a single event for sql_queries using new flag. 32394
  • Add distribution type metrics for GCP. 32170

Packetbeat

  • Add support for specifying default route interface sniffing. 31905 31950
  • Add support for TCP transport to the SIP protocol. 28166 32346